HostnameBleed covers code scanning alerts #435 and #436, rule js/incomplete-hostname-regexp (CWE-20), in tests/marathiTranslationProgress.test.cjs. The test passed a.example.com and kanban.example.org directly to RegExp, so each dot acted as a wildcard. A wrong hostname such as aXexampleXcom could therefore satisfy coverage that was meant to require the exact documentation example.

The affected code runs only in a translation regression test over hardcoded strings. It is not shipped in the server or browser bundle, accepts no request or user input and denies no operation, so there is no attributable runtime attempt to record in Admin Panel → Problems.

The test now uses exact includes() comparisons. Positive and negative cases prove literal dots are required, while a repository-wide source guard detects the reported loop-to-RegExp shape and confirms it exists nowhere else in tracked first-party JavaScript.

The fixed-width transparent edit overlay previously covered the leading half of every title, which swallowed every pixel of a short rendered markdown link. The title container itself is now the edit target, while nested viewer links receive and stop their own click before editing can open.

Keyboard access remains on the title container, and its focus semantics are preserved. Positive and negative source tests cover the event boundary; a live Chromium regression edits a title to a markdown link, clicks it, and proves that the editor stays closed.

Card sorting and opened-card window dragging previously claimed mouse gestures that began inside a title textarea. Those editors and their controls are now excluded from sorting, and the window-drag handler returns before suppressing the browser’s native selection behavior.

Source regressions pin both drag boundaries. A live Chromium test drags across an opened-card title, verifies a non-empty selection range and confirms the card window did not move.

Specs that open a card now activate the shared wrapper-link helper instead of clicking title text, whose intended action is inline editing. The Firefox mouse selection regression keeps both drag coordinates over rendered title text, and the failed-copy negative check uses the stable board canvas rather than a strict union that fails when both healthy regions are visible.

The affected title-selection, failed-copy, LTR/RTL card-panel and board-comment paths pass together in a fresh Chromium run. Firefox and WebKit remain covered by the full Docker browser matrix.

The per-render exception boundary already added in 75a23b76a catches markdown or sanitization failures and returns safe escaped text, so one bad comment does not abort the card comment list or Activities rendering. The reported French emphasis, list and literal greater-than forms now run through the real shipped markdown configuration as explicit regression coverage.

The route previously discarded removeAsync’s result and returned the requested id even when no account matched. It now returns 200 only when exactly one user was removed, returns a deterministic 404 for zero matches and treats unexpected counts or database failures as internal errors.

Repeatable response annotations let the OpenAPI generator document the exact 200 and 404 response bodies. Unit and negative tests cover authorization and every removal outcome, regenerated YAML matches the route source byte for byte, and a live Chromium API test confirms deletion in MongoDB before repeating the request and receiving 404.

The remaining 417 Swati strings now cover jobs, storage, migrations, backups, privacy, monitoring, repositories and imports. A same-script vocabulary audit also replaces the Zulu word ibhodi with the Swati libhodi.

Regression coverage proves the locale has no English placeholders, preserves the exact source placeholder and HTML inventories and uses Swati vocabulary. These direct translations have lower confidence than reviewed human work and remain open to correction by Swati speakers.

The first 50 Sesotho strings translate activity titles and descriptions, members, comments, dates, attachments, labels, checklists, custom fields, archives and imports. Source placeholders remain exact, and a language-specific regression checks Sesotho vocabulary while recording the 2,117 strings still untranslated at this commit.

The translation documentation now reports 197 essentially complete locales, and the Northern Sotho regression expects its measured zero remaining English placeholders. Tests calculate these values from the locale files so stale completion claims fail visibly.